start	end	text
10180	15820	Hey everybody. Alright, thanks for coming to Not A Google Talk.
20960	25520	And those of you that have seen me speak before know that this is going to drive me absolutely
25520	30580	insane. I cannot stand in one place. You see me doing a little dance, that's what it's
30580	36120	all about. Alright, let's get started. Just a show of hands, how many of you have read
36120	41600	any of the books in the Stealing the Network series? Show of hands. Excellent. How many
41600	46780	of you have Stealing the Identity, the latest in the series? Excellent. How many of you
46780	52980	are authors in Stealing the Identity? There we go. There it is, show of love. Alright,
52980	56980	what we're going to do here is, those of you that aren't familiar with the stealing story,
56980	62400	there was some interesting stuff that happened in the book with this psychopath named Newt
62830	68040	who happens to be sitting in the front row. I won't point him out, but you can narrow
68040	74940	it down from the hands that went up. Anyway, this guy Newt was up to absolutely no good.
74980	79700	His whole thing was he didn't want to get caught by the man. So what he did is he took
79700	85560	all his hard drives, took all his CDs, took all his removable media, and melted them down
85560	91840	when he was done doing his thing. Now when Singers came to me and they were like, hey
91840	98240	we got this great book series called Stealing, we want you to write on it. I was like, sweet.
98320	105200	I was like, this is excellent, rock on. They were like, well you get to catch Newt. I was
105200	111200	like, oh. Well the bottom line was, it was a tough job. So what I'm going to try to do
111200	115340	is I'm going to try to give you an idea of what it's like to try to catch a guy like
115340	120940	this who's ultra paranoid, who does everything in his power to basically keep from getting
120940	127460	caught. And as it turned out, Newt's death was going to be a death by a thousand cuts.
127460	131860	I'm not going to ruin anything and I'm not going to say that Newt died, but you'll have
131860	139380	to read the book to find out. Alright, so anyway, that's basically all that stuff that
139380	144560	I said. We are going to be looking at Newt's place through the eyes of this guy I'm calling
144560	151260	Uber Agent. So for the next half an hour, 40 minutes or so, you get to play Uber Agent.
151380	157080	And we're going to have some interesting games as we go through here. We're going to be playing
157080	163180	some find the evidence games, where you guys as an audience have to try to find the evidence
163180	168680	in various places. I'm going to show you some pictures, we're going to have a little fun
168680	173300	with it. I've got a pile of books up here that I'm going to be giving away to those
173300	179020	of you that find the evidence the quickest. The whole hand-raising thing, it's not going
179020	186860	to cut it. If you want a book, and I'm doing a find the evidence contest here, you have
186860	192620	to stand up and scream at the top of your lungs the correct answer. You've got to commit
192620	198940	if you want the books. Now, we're going to start off pretty lightweight. This is not
198940	212220	for a prize. Please remain seated. Help me find the evidence. Thank you. We're going
212220	218100	to start off pretty easy. Now, in the stealing book, Newt did not have an iPod. That wasn't
218100	222400	part of the story. But one of the interesting devices that I'm seeing all over the place
222400	226580	are these iPods. And everybody knows they hold music, they can hold data, the whole
226580	230640	nine yards. But the bottom line is there's a whole lot to it that folks really haven't
230640	234620	considered. So what I'm going to do is sort of take you through what some of that stuff
234620	246400	might be. First of all, this is the standard practice for the man, the Fed, is to grab
246540	250620	a device like this and pick it up and sort of flip through it and see what's there, hit
250620	256220	that little about menu, get information from the iPod. Well, the simple fact of the matter
256220	262200	is that's bad news. Picking up any sort of device on a scene and mucking with it is going
262200	267040	to potentially destroy evidence. And if a decent lawyer gets a hold of that in court,
267040	273700	that evidence that you discover is going to get tossed. So doing this is a bad idea. So
273700	278480	let's talk about some of the things that we can do to sort of investigate these things.
278580	284280	I'll be the first to tell you, and no offense to those that do forensics full time, forensics
284280	295960	is a little bit dry. No offense. I mean, CSI is very cool, right? The slightly aging but
295960	301040	still quite attractive redhead and the not so aging and quite attractive brunette make
301040	306140	it interesting. But that has nothing to do with forensics. But I'll try to spice it up
306260	314260	a little bit. All right. As far as an investigative platform for these things, I hate to be the
314280	321260	some sort of raving Mac fan. But the simple fact of the matter is if you've got an iPod
321260	326340	that was formatted on a Mac, the best way to actually take apart that iPod forensically
326340	332500	is by using a Mac. One of the best reasons for that, the biggest reasons for that is
332500	339740	quite simply the HFS plus support. The iPod is basically an HFS plus portable file system.
340320	346620	That's a Mac native file system. That's not to say Linux can't handle it. Linux can handle
346620	353220	HFS plus. But it's not native on Linux. And Windows with HFS plus, well, just forget about
353220	357280	it. All right. The bottom line is most of the time you're going to want to be using
357440	361500	a Mac to actually pull these things apart. All right. Now, one of the things that a good
361500	366120	investigator has to sort of figure out, and this is all part of the big puzzle, is I've
366120	370120	got an investigative platform, what do I actually have to do to keep from tampering
370120	376760	the evidence that's on this thing? All right. And one of the things that needs to be considered
377360	382760	is the fact that when you slap an iPod into a Mac, you connect it up, one of the first
382760	388140	things that happens is this demon, this disk arbitration demon, actually latches onto the
388140	393780	iPod. This is the demon that actually causes things like iTunes to launch and the contact
393780	398980	lists to update and all that stuff to sync. Well, from an investigative standpoint, that's
398980	405300	bad news. All right? You don't want your investigation machine tramping all over this iPod and destroying
405300	409860	evidence. So one of the first things you need to do is you need to hammer this demon. Now,
410500	415740	this demon automatically restarts when you kill it. Okay? So actually what you have to
415740	421160	do is you have to take this demon and you have to change mode it to 0, 0, 0, physically
421160	426880	change mode the binary in S bin and then kill it. Okay? Now, once you do that, you
426880	431160	get to the point where you've got a device that you can actually hook up to a machine
431160	437560	and start looking for evidence. All right. But we're not exactly there yet. One of the
437560	440940	other things that we need to do is we need to hook this thing up so that it's in sort
440940	445560	of a read-only mode. Okay? And that takes a little bit of work as well. Just killing
445560	449840	the demon that automatically connects to this thing and launches iTunes isn't going to be
449840	454380	enough. So we need to get it into sort of a USB disk mode. How many of you have been
454380	460720	inside an iPod's diagnostic mode? Show of hands. Okay. How many of you have actually
460720	467900	used an iPod? Okay. Quite a few. This diagnostic mode is key to actually pulling stuff off
467900	474620	of the iPod without totally hosing yourself in court. And this is a third generation iPod.
474620	479940	The way this thing works is slightly different. And I know this looks like a cheat on like
480060	485260	a PlayStation or something. Right? So you power it off. You hold down the forward, the
485260	489720	backward, and the center button. Select and release them all at the same time. If you do
489720	495200	that, you get the cheat code. All right? And the cheat code is diagnostic mode. You get a
495200	498740	menu that looks something like this. It's got a bunch of different options. One of the
498740	505300	things that we're going to hit is we're going to hit USB mode inside the iPod. After we
505300	510500	reboot, we get a screen that looks like this. All right. At this point, you sort of have a
510500	515060	choice between treating this like a fire wire device and a USB device. I'm going to fly
515060	518840	through the boring stuff. Once you get all that done, you get a screen that looks like this
518840	523700	that basically says I'm in disk mode. So the iPod is no longer an iPod. It's basically a
523700	528880	disk that's about as close to read-only as you can get. Now, the reason I'm dragging you
528880	533700	through all this boring stuff is most people don't realize how difficult it is to actually be
533700	537860	an investigator, to be one of the good guys, to actually go through all this stuff to try to
537860	546240	catch, well, people like you. But the bottom line is, you know, the good guys are pretty
546240	550720	smart, too. Not that I'm choosing sides here. And they're not nearly as dumb as we paint
550720	554800	them out to be. Simple fact of the matter is, they will go through this process to actually
554800	559660	get to your stuff that's on the iPod. So the question becomes, what exactly can be on an
559660	566600	iPod? Here's a file listing. The iPod actually just shows up as another device on the
566600	571720	machine. So we mount the device. We do a listing. Can anybody see anything interesting
571720	583070	about this file listing? Anything that stands out? Next time, answer slower so I can
583070	593670	swallow. Yeah. Whew. Yeah, there's a nopics. There's a nopics.img file on here. This is a
593670	597910	persistent encrypted nopics home directory. Those of you that use nopics realize what this
597910	602850	thing is. The bottom line is, yeah, you can absolutely put whatever you want on this
602850	607210	iPod as a file. But one of the things that gets really interesting is when you start using the
607210	613390	iPod for other things, for example, booting it, booting from it as a device, okay? Booting
613390	618810	from it with a nopics CD or booting from it absolutely natively. Actually loading a
618810	622930	distribution of nopics on it, booting right from the iPod. You've got basically a
622930	627730	portable platform. It's got all your attack tools on it. You can use it just like any
627730	634650	other machine. Hook it up, boot, and you go. Where's Tyler? Is Tyler here? Where's Tyler?
634650	640790	All right, Tyler. Thank you. Everybody give our newest goon, Tyler, a big round of applause
640790	648740	right there. All right. Now that I've absolutely embarrassed her and she's going to hide
648740	653620	from all of you. Tyler actually submitted a talk that had nothing to do, that had everything
653620	657760	to do with iPods. It was just about iPods and all the cool stuff you can do with them.
657760	662500	She's actually got a shuffle that she can boot from that boots nopics but also comes up in
662500	666220	iTunes natively so that it can have music running from it, attack tools, the whole nine
666220	671240	yards. Yeah, with a little device the size of a stick of gum. It's pretty cool stuff.
671240	675780	Show of hands, how many people would have been interested in a talk like that? Cool.
675780	681300	Thank you. All right. Anybody that's on the review board, take note. All right. I've done
681300	688300	my plug. Okay. There's obviously other stuff that's on an iPod. This shows a screen from
688300	693800	an AAC file, just a music file. Those of you that have messed around in the AAC space know
693800	697920	that you can absolutely use these things and lock them down so that you have to authorize
697920	701880	them on various machines and all that. Well, the thing that's interesting from an evidence
701880	705340	standpoint, remembering we're supposed to be Uber agent here trying to catch that guy,
705340	711680	oh, not going to point at him, that bastard Newt, who's ultra paranoid, is that we need
711680	720220	to look in places like music files on an MP3 player in ways that are not necessarily standard.
720220	724280	For example, you can see when I launch this AAC file that the registered e-mail address
724280	728880	pops up. This is the user that actually, you know, purchased this song. It's the e-mail
728880	734060	address that they used. So, yeah, you can pull out e-mail addresses from the music files
734060	742300	as an investigator, use those for more leads. Okay. The other thing that's often overlooked,
742300	746900	and I know this is old news, but metadata inside the files. You know, you get a music
746900	750840	file, you get any kind of file, there's a potential for metadata. You can have all sorts
750840	758470	of stuff in here. Anybody see anything odd with this one? Wow, you guys are good. Yeah,
758470	763110	the comments field. There's been a lot of work done recently in covert channels. A good
763110	766910	friend of mine, Russ Rogers, is doing the hacking the terror network book, talks about
766910	771970	covert channels and things like that. The simple fact of the matter is, as bad guys,
771970	778030	I'm not generalizing, but, yeah, as bad guys, you know perfectly well that you can use covert
778030	781950	channels just about anywhere. Music files are no different. A really good investigator
781950	785770	is going to actually look in those files to see if there's anything that's out of the
785770	793720	ordinary. And this is just one of the spots that he's going to look. All right. Also,
793720	797220	the normal stuff that would be on an iPod, you can have your contact list, you can have
797220	803040	your calendar, you can have all that stuff. This is just an example, but, yeah, your address
803040	807740	book syncs to it, so an investigator is going to pull all that stuff off. Yada, yada, yada.
808640	815020	All right. Other things about MP3 files in general is a lot of them use the metadata
815020	818760	to store information about last time played and all that kind of stuff. All that stuff's
818760	822380	going to be on there. Also, if the investigator is really good, one of the things he's going
822380	825940	to do is he's going to take all the music files, he's going to run hashes against them.
826180	831660	And if there's peer-to-peer software on the machine, the bad guy's got peer-to-peer software,
831660	837520	he's actually in some cases going to check the file hashes of the same songs on a peer-to-peer
837520	841660	network to see if the file hashes match. You know, if you've got somebody that's just
841660	846020	pirating music, there's a good chance that these hashes are going to match. If the investigator
846020	854540	finds a song whose MD5, I'm sorry, you don't use MD5 anymore, thanks, Dan, your SHA1 hash
854540	861880	doesn't match, it'd be something worth looking at. All right. Digital cameras. Obviously,
861880	865940	I'm doing some of the more obvious things first, because, you know, investigators, we're
865940	869620	just going to do real obvious stuff. Digital cameras, absolutely, they're going to be picked
869620	875900	up. What about the images that are actually on these cameras? Well, first of all, yeah,
875900	882660	there are images on digital cameras. Hello. You know? I think a lot of investigators and
883220	886700	a lot of the good guys actually forget the fact that they're pictures, they're not just
886700	891380	data. So the simple fact is actually looking at the pictures themselves to try to pull
891380	897120	out evidence from the image themselves is a good idea. For example, here's an image
897120	902600	with all sorts of metadata. I know it's probably very hard to read, but can anybody tell me
902600	911520	what's wrong with this picture? What was it? Huh? There's lots of network cables, yeah.
911640	917080	Let me give you a little bit of a hint. The date time stamp on here shows the time as
917080	926250	being approximately 4 in the morning. Absolutely. Shouldn't be daylight. Okay? The simple fact
926250	931370	of the matter is there should not be daylight at 4 o'clock in the morning, and the question
931370	938350	is what does that mean? Okay? As evidence. You know? Could mean a lot of things. Could
938350	942230	mean the date time stamp on the camera is broken. What if the date time on the camera
942230	948670	is right? That's right. The picture was taken in a different time zone. So it's things
948670	953410	like that. The actual time on the digital camera, you can't pull off. You actually have
953410	959250	to look at the digital camera itself and figure out what the time is set to. This was actually
959250	965610	used in one of the books to catch somebody that was, and this was the stealing book,
965610	969830	to actually figure out that somebody took the picture in another country. Okay? So the
969830	974350	investigator actually picked up on that and went, okay, what are my choices? What countries
974350	979070	is this daylight? Let's narrow it down. Let's cross-reference it. Yada, yada, yada. Another
979070	987270	plug for stealing. Thank you. All right. A little bit more about EXIF stuff. Are the
987270	993370	date times consistent with the pictures? There could be potential for thumbnail inconsistencies.
993370	997030	You look at a picture, you look at the embedded thumbnail. If it's been processed in some
997030	1001070	sort of imaging program that didn't update the thumbnail, you can see the inconsistencies
1001070	1008310	there. All sorts of stuff. All right. Now, I know these are very hard to read, but there's
1008310	1016030	two images here. Can anybody tell me what's different between the two images? Good. Sizes.
1016850	1022950	The create time and dates are different. The stamp on the camera software has changed.
1022950	1030410	It's gone from being an actual camera stamp to being a Photoshop stamp. I know this is
1030410	1034350	old stuff, but the bottom line is the good guys are actually going to be using these
1034350	1038990	techniques to figure out if you've processed an image outside the camera, modified it in
1038990	1049270	any way, et cetera, et cetera. All right. Now, this one's easy, so it's not for a book.
1050050	1059550	Not for a book. Sorry. Okay. No, it's not the USB. Sit down. For a book, where's the
1059550	1075210	evidence? She stood up and was very bold, and you get a book. Come on up. All right.
1075350	1080550	Very nice. You get the idea how this game works, right? Yeah, there's a USB there. There's
1080670	1084730	a PowerBook sitting there. Yeah, it's real obvious places to look for evidence. But yeah,
1084730	1089470	there's a phone in the picture, okay? And it's, you know, just a normal phone that you'd
1089470	1094910	find on the desk in just about any office. But the simple fact is that there's possible
1094910	1100470	data inside this phone that might not show up in things like call logs. For example,
1100470	1105890	you dump the PBX logs, there's all sorts of stuff jammed in the redial. For example, in
1105890	1109770	this, you know, I wasn't gonna show you any real PIN numbers. I dial up a number, I put
1109770	1114850	in a PIN number, it's actually captured inside that redial info. By playing with the phone,
1114850	1120970	you can get that information out. It might be lost in a call log. All right? Other things
1120970	1125610	that you can get, you can get park settings, in-dial forwarding, all sorts of information.
1125610	1131010	Again, this stuff might not necessarily show up anywhere else. If the desk phone is forwarded
1131010	1136370	to a cell phone, the phone itself might be the only place to actually get that information.
1136370	1144170	So a good investigator's actually gonna consider this stuff. Speaking of phones, cell phones,
1144170	1150030	most of you guys know this stuff, but just for completeness, cell phones have cameras
1150030	1153970	in them, obviously, you've got images in them, yadda, yadda, yadda. A lot of them have SD
1153970	1159170	or mini SD cards inside of them. Those SD cards should be removed. It's not necessarily
1159170	1163330	the same as a SIM card. There could be other stuff that's on there. How many saw Mudge's
1163330	1168630	talk this morning? Show of hands. All right. One of the things that I found very interesting,
1169030	1172870	a couple things I found interesting about Mudge's talk was he pulled out his sidekick
1172870	1178190	phone. And one of the things that he revealed was that when he basically lost his phone
1178190	1184190	and got another phone, all his images and all his phone lists were automatically populated
1184190	1190030	back down to his sidekick. Brand new phone, brand new SIM card. So the images actually
1190030	1194890	went out to the website and once he re-registered, they came back down to his phone. Bottom line
1194890	1201710	is this is fairly transient stuff that might be hard to pick up any other way. All right.
1202110	1207030	Printers. Printers are often overlooked. Let's take a look at some of the ways you can actually
1207030	1213530	pull evidence off of printers. One of the things an investigator has to consider, especially
1213530	1217850	an investigator of the caliber that's required to catch somebody like Newt, is that every
1217850	1223510	piece of evidence is absolutely critical. You can't mess around with destroying evidence.
1223510	1228050	So one of the things that you have to consider is the fact that simply printing a page off
1228050	1233830	of a printer could potentially destroy evidence. Some of the things that you can do, you can
1233830	1238410	actually pull data off the transfer drums if you're like incredibly paranoid or you
1238410	1243210	have access to electron microscopes. You can pull data outside of actual semiconductors.
1243210	1248170	You can do all this scientific stuff. Okay, but even if you're not that desperate, there's
1248270	1252810	a lot that you can do right from the LCD menu. So for example, here's the information menu
1252810	1257510	on a laser jet printer. You can go in there, you can actually print off the event log to
1257510	1261530	see what events actually happened on the printer, when the toner died, when there were paper
1261530	1266790	jams, all that sort of stuff. Get documents that look like this. One of the things that
1266790	1271270	you can see is time and date stamps on all the events on the printer. A lot of those
1271270	1276610	events can't happen unless somebody's actually at the printer. Okay, so a good agent is going
1276610	1281550	to use this stuff to actually correlate time, you know, to see, okay, was the guy in the
1281550	1285250	office at this point? Was he at the keyboard? Does that correlate with forensics logs that
1285250	1292110	we have off the wire? Et cetera, et cetera. The other things, there's lots of stuff that
1292110	1296110	you can do, and I'm really skimming, so I'm trying to keep this, you know, fairly interesting.
1296510	1300710	You can do a lot from the LCD screen itself without printing. Like, you can actually view
1300710	1304830	the event log from the LCD screen without printing. So you go through the information
1304830	1308870	menu, and even though it's a little bit cryptic, you know, an agent can use the LCD screen
1308870	1313930	to actually write down the event log itself, and then translate all this information into,
1313930	1320190	you know, real stuff. The other thing is a lot of printers have web interfaces. Yes,
1320190	1326530	I ripped this from one of my Google talks, but yeah. And yeah, there's the Google query
1326530	1332370	in the top that found the example. And the little oval button that says configuration
1332870	1339250	wizard. But anyway, that's the Google talk. I'm doing a different talk now. Where am I?
1339250	1344710	Who are you people? But anyway, yeah, you've got web interfaces on printers. You can connect
1344710	1350590	to them. You can get lots of information off of those. This printer, for example, this
1350590	1355230	Ricoh, it actually queues up print jobs through the web interface, so you can go into the
1355230	1359230	web interface and actually get print jobs off of that. Again, good evidence from an
1359230	1366830	investigator's standpoint. A couple more things. Fax machines are often overlooked because
1366830	1370910	of the fact that most of the time an investigator is going to get call logs. You know, they'll
1370910	1375670	go to the PBX, they'll actually pull back the call logs. Fax machines themselves can
1375670	1380730	absolutely contain evidence. Again, we're at an LCD screen thing where you can actually
1380730	1387650	go in and get time, date, headers, company name. Again, you can see that bastard, Nooth.
1388190	1391770	You can see fax functions, phone numbers. You can see all sorts of stuff, again, just
1391770	1396710	by going through the LCD menu. A lot of times investigators tend to pass by these devices
1397170	1400210	Investigators these days are getting better and better and even pulling evidence off of
1400210	1407330	these. All right, some more stuff. The phone book entry can be pulled off and transmission
1407330	1411590	reports, again, date, time stamps, places that were called, produce reports that look
1411590	1415970	like this. So you've got the number that was called, the duration of the fax, the number
1415970	1425310	of pages, all sorts of stuff. All right, faxes and multifunction devices. Multifunction devices,
1425310	1429230	printers, fax machines, copiers, all that stuff. They pretty much act the same way.
1429230	1433250	It's a printer, it's a fax machine, whatever. The bottom line is that device can contain
1433250	1438970	evidence and this is a talk in and of itself, but everybody pretty much knows that network
1438970	1445270	devices themselves can contain a lot of data. You got a Cisco, you got a wireless device.
1445270	1451270	Those devices can contain information. Network devices actually played a critical role in
1451270	1456470	figuring out exactly what Newt was up to because even though the guy melted down his
1456470	1461310	hard drives, used a belt sander on his CDs and got rid of all his disposable media stuff,
1461310	1465450	the removable media stuff, he left behind the actual desktop machines and his network
1465450	1470270	gear and his printer. Okay, so at that point, an investigator has to, you know, frigging
1470270	1479230	catch the guy with just what's left over. Okay, now this is going to be fun. Our next
1479230	1486450	slide is for a book, all right? And I'm going to push the little button here and see if
1486450	1507800	you can find the evidence. Who said that? Come on up. What's that? Oh, man. That's excellent.
1507800	1513300	Yeah. Fingerprinting model glue from none other than Mudge. Thank you, sir. Come on
1513300	1519020	up. Do you have something to drink? You should be just sitting up here. So everybody welcome
1519020	1537420	Mudge. And no, he hasn't been sniffing model glue. Yeah, that was excellent. Whoever jumped
1537420	1541600	out of their freaking seat right there, dude, you are the man. Yeah, look at all this stuff.
1541640	1545980	All right, you got USB drives, you got PDAs, you got all this stuff, you got CF cards,
1545980	1551320	you got all this crap all over here. Well, let's clear the table. And where's the evidence
1551320	1557880	now? Yes, those are breath. No, no, no, that wasn't for a book. I like this. We're going
1557880	1562660	to get the wave going. This is going to be hot. All right. Yeah, those are breath strips.
1562660	1566880	And no, that's not the evidence. But yes, this happens to be a USB watch. Hook this
1566880	1572460	puppy up to a machine. It's actually got USB storage. A decent agent is not going to overlook
1572460	1576240	something like a watch. They're actually going to pick this stuff up. Going to pull the data
1576240	1595160	off of it. Holy crap. Come up here and say that. I just pointed out if it was actually
1595280	1598760	a mechanical watch at any point on the inside, that based upon the spring expansion, you
1598760	1602320	could figure out roughly the date that it was created and be able to go back to figure
1602320	1613230	out when they were sold. Thank you. All right. I've been told that I can talk as long as
1613230	1631940	I want. No. Unfortunately, the mob can't speak for my day job, which would absolutely
1631940	1637000	get rid of me if I was on the TCP IP drinking game. Thank you for the invite. You can call
1637000	1645160	me a wuss if you want, but I'll be watching safely from the front row. Thank you. I'll
1645160	1651000	be cheering for Mudge, though. All right. Here we go. This is for a book. Yeah, we're
1651000	1663620	okay on books. All right. Everybody ready? What did you say? Come up here. He stood up
1663620	1673680	boldly and he proclaimeth. Pen. Very nicely done. Pick a book. Oh, that is my blockbuster
1673680	1682040	card, isn't it? And my yo-yo. I have yo-yo skills. I do. Maybe if we're killing time,
1682040	1688000	I'll do some yo-yo kung fu up here. Yeah, absolutely. The bottom line is USB pen devices.
1688000	1691620	They're a lot more common than you think. You get a drawer filled with junk like this,
1691620	1697120	there's going to be crap that's hiding in the crevices. If you've got to think geek
1697120	1701520	shop and fool that you're trying to catch down, he's going to have stuff like this.
1703060	1706960	And you can figure out how much ink is in it and do an analysis to figure out how long
1706960	1712900	he's been. Where do you come up with this stuff? This is why I would never be on a TCPIP
1712900	1720340	drinking game against this guy. That's true. That's true. All right. Yeah, good stuff.
1720340	1731540	All right. Let's do another one for a book. You guys ready? Nope. Wait, I heard it.
1733740	1763640	There it is. Right over here. I heard it. Yes. Lo and behold, it is the duck. Yeah, baby.
1770670	1775090	That was very nicely done. Oh, and all you people that were just calling out without
1775090	1779330	standing up, do not think that that will get you a book. That's not the enthusiasm I'm
1779330	1786950	looking for. We're down to two books, so I think I might skip this one and make this
1786950	1793090	one a freebie. Yeah, we're going to skip this one and make it a freebie. All right. It's
1793090	1810420	not for a book. You can stay seated. Fluoride? What? USB Clorox sounds definitely like something
1810420	1832670	Mudge would have said. It does look like the Unabomber was there. USB TP. Here it comes.
1832670	1843730	You ready for it? Ready for it? Here it comes. What is it? USB flashlight. Yes, this is an
1843730	1850310	embedded USB digital camera flashlight combination. Yeah. Uber agent is going to pick that stuff
1850310	1855970	up. Let's take a look at this one. I really got to spread these books out here, man, because
1855970	1862810	I got a lot more slides. All right. This one's not for a book. It's just kind of fun. Can
1862810	1869850	anybody find the evidence in this picture? Oh my goodness. You are Uber. Without any
1870490	1878490	hesitation whatsoever and without the benefit of the Zoom, he proclaims TikiTorch. There
1878490	1883510	it is. This is a very nice TikiTorch that normally I would tell you to go to a place
1883510	1891190	like ThinkGeek to actually purchase. But ThinkGeek did not think anything of the DEF CON conference
1891190	1894070	because when I called them and said I was doing this talk and I'd really like to get
1894070	1901150	some pictures of their gear, guess what they said? They said nothing. So buy it somewhere
1901150	1910970	else. Bastards. I borrowed this from a friend who didn't get it from ThinkGeek. Okay, you
1910970	1921010	guys are so smart. Let's do it again. Where's the evidence? Nope. The what? Not... Ooh,
1921010	1927090	that was nice. From the front row, we have the digital photo picture frame. Yes, USB-capable
1927090	1933870	digital photo frames can contain data. It's an excellent spot to hide stuff. Good job.
1934950	1945210	All right. Let's do this again. Where's the evidence? Not the stapler, but he stood. Not
1945210	1957330	the network card. Nice. Right here. The knife. We got it. We got the answer. No, it's not
1957330	1961450	the Microsoft coaster, which most of you should have just taken one look at and gone, there's
1961450	1967910	something suspicious about that. No, it's not Kevin Mitnick's business card, which most
1967910	1975190	of you should have gone, there's something suspicious about that. It is actually... And
1975210	1984590	there it is. Come get a book. That was worth it. USB Swiss Army knife. Yup, USB Swiss Army
1984590	1994270	knife. I've never seen a USB stapler. Oh, that's... He actually said stapler and he
1994270	1999510	was right, but sorry, that wasn't the answer I was looking for. I'll give you other swag.
1999510	2005370	We'll do that. All right. You guys ready? This one's for a book. Find the evidence.
2024690	2032010	Do not listen to Mudge. His idea is way too smart. No, there's no evidence here, people.
2032010	2053120	It's a bowl of fruit. You guys are not very good Uber agents. Oh, that was kind of cool.
2053120	2056000	I wanted to pull a Mudge and answer my phone when somebody was calling me while I was on
2056000	2061420	stage. That would have rocked. All right, let's see. I think this might be our last
2061420	2068200	one for a book. No, we'll do it in the next picture. This one's just a freebie. Where's
2068200	2074360	the evidence? Oh, yes. You guys are getting the hang of this. I heard it on the right.
2074440	2082000	Here it comes. Wait for it. Wait for it. There you go. USB camera binoculars. Okay, you guys
2082000	2085660	are getting the hang of this. Whole point of the talk is that it takes an interesting
2085660	2091160	outlook on various locations like this to find stuff that could potentially be meaningful.
2091300	2095200	When you've got a world that's filled with digital devices like this, it's going to take
2095320	2099280	a death by a thousand cuts to catch somebody like Newt. That's what the entire book is
2099280	2102920	about. I hope you guys will check out the stealing book. Let's do our last one for the
2102920	2107400	book. And we need some enthusiasm here. You've got to stand up or you're not going to win
2107400	2118830	it. Where's the evidence? Mudge. Who was it? Who was it in the back that said sushi?
2118850	2130950	Come forward. No, it wasn't Bruce Sterling's Zenith book. It was the sushi. We've got to
2130950	2137390	get the transition work in here. Go with the flow. Nice. Thank you. All right. So anyway,
2137390	2148890	USB sushi. All right. So you guys got the hang of this. That's the idea. Other places
2148890	2152810	evidence can hide. You guys have probably seen most of this stuff. I couldn't actually
2152810	2156450	taunt you by putting these into a picture because most of them were too easy. How many
2156450	2162130	of you have actually seen these Oakley thump glasses like in person? These things rock.
2162710	2169390	They also look like freaking Vulcan space goggles. All right. So anyway, Newt was an
2169390	2173410	ultra paranoid and did everything right, but in the end was he busted. I'm not going to
2173410	2176630	spoil it. You'll have to get the book to find out. Stealing the network, how to own the
2176630	2180310	identity by Singer's Publishing. We're going to do a book signing right after this over
2180310	2184870	at the book booth inside. We've got several of the authors of various books. Specifically
2184870	2189050	we're going to do ASD, but we'll have lots of folks over there. So if you have questions,
2189050	2190450	see you over there. Thanks a lot.